@adcp/eslint-plugin 0.0.0

package/README.md

@@ -0,0 +1,163 @@
+# @adcp/eslint-plugin
+
+Build-time lint rules for [@adcp/sdk](https://www.npmjs.com/package/@adcp/sdk)
+adopters. Catches the credential-handling antipatterns that the SDK's runtime
+guards already flag, but at code-write time — so the bug never ships.
+
+## Install
+
+```sh
+npm i -D @adcp/eslint-plugin eslint
+```
+
+## Wire up
+
+**Flat config** (`eslint.config.js`):
+
+```js
+import adcp from '@adcp/eslint-plugin';
+
+export default [
+  {
+    plugins: { '@adcp': adcp },
+    rules: {
+      '@adcp/no-credential-read-from-args': 'error',
+    },
+  },
+];
+```
+
+**Legacy `.eslintrc`**:
+
+```json
+{
+  "plugins": ["@adcp"],
+  "extends": ["plugin:@adcp/recommended"]
+}
+```
+
+## Rules
+
+### `@adcp/no-credential-read-from-args`
+
+Flags reads of credential-shaped keys off the buyer-supplied `args` bag
+inside `extractContext` / `synthesizeFromArgs` platform method
+implementations.
+
+```ts
+// ❌ flagged
+const platform = {
+  extractContext(args) {
+    return { token: args.snap_access_token };
+  },
+};
+
+// ✅ ok — re-derive bearers from authInfo + token cache
+const platform = {
+  extractContext(args, ctx) {
+    return {
+      accountId: args.account_id, // non-secret upstream ID
+      token: tokenCache.get(ctx.authInfo), // secret comes from authInfo
+    };
+  },
+};
+```
+
+Detection keys on **method name**, not interface type — duck-typed
+`definePlatform` shapes and class methods that don't `implements` the
+interface explicitly are both covered.
+
+Credential-name patterns are imported directly from
+[`@adcp/sdk/server`](https://github.com/adcontextprotocol/adcp-client/blob/main/src/lib/server/credential-policy.ts)'s
+`DEFAULT_CREDENTIAL_PATTERNS`. The runtime guard
+(`credentialPolicy: 'authInfo-only'`) and this rule share one regex set —
+adding a pattern to the SDK surfaces it here automatically.
+
+#### Option: `additionalPatterns`
+
+Adopters who extend the runtime matcher with `credentialPolicy.patterns.extend`
+can mirror the same strings here for lint parity:
+
+```js
+// eslint.config.js
+import adcp from '@adcp/eslint-plugin';
+
+export default [
+  {
+    plugins: { '@adcp': adcp },
+    rules: {
+      '@adcp/no-credential-read-from-args': [
+        'error',
+        { additionalPatterns: ['platform_session_key', 'vendor_bearer'] },
+      ],
+    },
+  },
+];
+```
+
+```ts
+// matching runtime config — keep the two lists in sync
+createAdcpServer({
+  credentialPolicy: {
+    mode: 'authInfo-only',
+    patterns: DEFAULT_CREDENTIAL_PATTERNS.extend(['platform_session_key', 'vendor_bearer']),
+  },
+});
+```
+
+Each entry is compiled as `new RegExp(pattern, 'i')` and appended to
+`DEFAULT_CREDENTIAL_PATTERNS`. A fully-replaceable `credentialPolicy.matcher`
+function has no lint analogue — see [Known gaps](#known-gaps).
+
+## Known gaps
+
+This rule is a code-write-time nudge, not the security boundary. The SDK's
+runtime guard (`credentialPolicy: 'authInfo-only'`) is what enforces the
+contract on the wire. The patterns below intentionally pass the linter
+because catching them at AST time would require cross-function or
+control-flow analysis and the false-positive cost is too high; the
+runtime guard catches all of them at dispatch.
+
+- **Aliasing** — `const a = args; a.access_token` (the rule only scans
+  reads rooted at the `args` parameter name).
+- **Spread** — `const ctx = { ...args }; ctx.access_token` (same — `ctx`
+  isn't `args`).
+- **Helper indirection** — `extractField(args, 'access_token')` (the
+  credential string lives in a sibling-function argument; cross-function
+  scope is out of scope).
+- **Computed access with a non-literal key** — `args[someVar]` (the rule
+  can't statically evaluate the key).
+- **Credential reads inside helper functions called from
+  `extractContext`** — only the body of the flagged method itself is
+  scanned; helpers it calls are not (cross-function scope).
+- **A fully-replaceable `credentialPolicy.matcher`** — function matchers
+  can't be expressed as a regex pattern list, so `additionalPatterns`
+  can't mirror them. If you replace the matcher entirely at runtime,
+  add explicit `additionalPatterns` entries here for the names you want
+  flagged at lint time.
+
+For all of the above, rely on `credentialPolicy: 'authInfo-only'` at the
+request boundary — it doesn't care how the read was spelled in source.
+
+## Why this exists
+
+The SDK already enforces credential discipline at the request boundary via
+`createAdcpServer({ credentialPolicy: 'authInfo-only' })`, which rejects
+incoming requests that smuggle credential-shaped keys through the `args`
+bag. That runtime guard catches mistakes at dispatch time.
+
+This plugin catches the same class of mistake earlier — at code-write
+time, in the editor, in CI, before the code is deployed. Same regex set,
+different boundary.
+
+See [`docs/guides/CTX-METADATA-SAFETY.md`](https://github.com/adcontextprotocol/adcp-client/blob/main/docs/guides/CTX-METADATA-SAFETY.md)
+for the broader credential-discipline guidance.
+
+## Phase 2
+
+Phase 1 (this release) ships the `no-credential-read-from-args` rule.
+Phase 2 (tracked in
+[#1541](https://github.com/adcontextprotocol/adcp-client/issues/1541))
+will add an `adcp doctor` CLI subcommand that wraps the linter for
+adopters who don't already run ESLint, and a suggestion-level
+`prefer-authinfo-credential-channel` rule with autofix hints.

package/dist/index.d.ts

@@ -0,0 +1,43 @@
+/**
+ * @adcp/eslint-plugin entry.
+ *
+ * Exposes the rules namespace and a `recommended` config. Adopters wire it
+ * as:
+ *
+ * ```js
+ * // .eslintrc.cjs
+ * module.exports = {
+ *   plugins: ['@adcp'],
+ *   extends: ['plugin:@adcp/recommended'],
+ * };
+ * ```
+ *
+ * Or, in flat-config style:
+ *
+ * ```js
+ * import adcp from '@adcp/eslint-plugin';
+ *
+ * export default [
+ *   {
+ *     plugins: { '@adcp': adcp },
+ *     rules: { '@adcp/no-credential-read-from-args': 'error' },
+ *   },
+ * ];
+ * ```
+ */
+export declare const rules: {
+    'no-credential-read-from-args': import("@typescript-eslint/utils/dist/ts-eslint").RuleModule<"credentialReadFromArgs", [({
+        additionalPatterns?: string[];
+    } | undefined)?], unknown, import("@typescript-eslint/utils/dist/ts-eslint").RuleListener> & {
+        name: string;
+    };
+};
+export declare const configs: {
+    recommended: {
+        plugins: string[];
+        rules: {
+            '@adcp/no-credential-read-from-args': string;
+        };
+    };
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,eAAO,MAAM,KAAK;;;;;;CAEjB,CAAC;AAEF,eAAO,MAAM,OAAO;;;;;;;CAOnB,CAAC"}

package/dist/index.js

@@ -0,0 +1,46 @@
+"use strict";
+/**
+ * @adcp/eslint-plugin entry.
+ *
+ * Exposes the rules namespace and a `recommended` config. Adopters wire it
+ * as:
+ *
+ * ```js
+ * // .eslintrc.cjs
+ * module.exports = {
+ *   plugins: ['@adcp'],
+ *   extends: ['plugin:@adcp/recommended'],
+ * };
+ * ```
+ *
+ * Or, in flat-config style:
+ *
+ * ```js
+ * import adcp from '@adcp/eslint-plugin';
+ *
+ * export default [
+ *   {
+ *     plugins: { '@adcp': adcp },
+ *     rules: { '@adcp/no-credential-read-from-args': 'error' },
+ *   },
+ * ];
+ * ```
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.configs = exports.rules = void 0;
+const no_credential_read_from_args_1 = __importDefault(require("./rules/no-credential-read-from-args"));
+exports.rules = {
+    'no-credential-read-from-args': no_credential_read_from_args_1.default,
+};
+exports.configs = {
+    recommended: {
+        plugins: ['@adcp'],
+        rules: {
+            '@adcp/no-credential-read-from-args': 'error',
+        },
+    },
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;;;;;AAEH,wGAA4E;AAE/D,QAAA,KAAK,GAAG;IACnB,8BAA8B,EAAE,sCAAwB;CACzD,CAAC;AAEW,QAAA,OAAO,GAAG;IACrB,WAAW,EAAE;QACX,OAAO,EAAE,CAAC,OAAO,CAAC;QAClB,KAAK,EAAE;YACL,oCAAoC,EAAE,OAAO;SAC9C;KACF;CACF,CAAC"}

package/dist/rules/no-credential-read-from-args.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Flag credential-shaped reads off the buyer-supplied `args` bag inside
+ * platform method implementations.
+ *
+ * Adopters keep reading `args.<vendor>_access_token` (and similar) inside
+ * `extractContext` / `synthesizeFromArgs`, silently trusting buyer-supplied
+ * identity material. The SDK's `credentialPolicy: 'authInfo-only'` catches
+ * this at dispatch; this rule catches it at code-write time.
+ *
+ * Detection is method-name keyed (`extractContext`, `synthesizeFromArgs`),
+ * not interface-type keyed — TypeScript type-graph analysis is unreliable
+ * against duck-typed `definePlatform` shapes and class methods that don't
+ * `implements` the interface explicitly.
+ *
+ * Credential-name patterns are the {@link DEFAULT_CREDENTIAL_PATTERNS}
+ * exported from `@adcp/sdk/server`. Importing the constant directly keeps
+ * the rule and the runtime guard in lockstep — adding a regex to the SDK
+ * surfaces it at lint time automatically on next adopter `npm install`.
+ *
+ * @see adcontextprotocol/adcp-client#1541
+ */
+import { ESLintUtils } from '@typescript-eslint/utils';
+type Options = [
+    {
+        additionalPatterns?: string[];
+    }?
+];
+declare const _default: ESLintUtils.RuleModule<"credentialReadFromArgs", Options, unknown, ESLintUtils.RuleListener> & {
+    name: string;
+};
+export default _default;
+//# sourceMappingURL=no-credential-read-from-args.d.ts.map

package/dist/rules/no-credential-read-from-args.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-credential-read-from-args.d.ts","sourceRoot":"","sources":["../../src/rules/no-credential-read-from-args.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,WAAW,EAA4B,MAAM,0BAA0B,CAAC;AAWjF,KAAK,OAAO,GAAG;IACb;QACE,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;KAC/B,CAAC;CACH,CAAC;;;;AA0MF,wBA2JG"}

package/dist/rules/no-credential-read-from-args.js

@@ -0,0 +1,360 @@
+"use strict";
+/**
+ * Flag credential-shaped reads off the buyer-supplied `args` bag inside
+ * platform method implementations.
+ *
+ * Adopters keep reading `args.<vendor>_access_token` (and similar) inside
+ * `extractContext` / `synthesizeFromArgs`, silently trusting buyer-supplied
+ * identity material. The SDK's `credentialPolicy: 'authInfo-only'` catches
+ * this at dispatch; this rule catches it at code-write time.
+ *
+ * Detection is method-name keyed (`extractContext`, `synthesizeFromArgs`),
+ * not interface-type keyed — TypeScript type-graph analysis is unreliable
+ * against duck-typed `definePlatform` shapes and class methods that don't
+ * `implements` the interface explicitly.
+ *
+ * Credential-name patterns are the {@link DEFAULT_CREDENTIAL_PATTERNS}
+ * exported from `@adcp/sdk/server`. Importing the constant directly keeps
+ * the rule and the runtime guard in lockstep — adding a regex to the SDK
+ * surfaces it at lint time automatically on next adopter `npm install`.
+ *
+ * @see adcontextprotocol/adcp-client#1541
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const utils_1 = require("@typescript-eslint/utils");
+const server_1 = require("@adcp/sdk/server");
+const FLAGGED_METHOD_NAMES = new Set(['extractContext', 'synthesizeFromArgs']);
+const createRule = utils_1.ESLintUtils.RuleCreator(name => `https://github.com/adcontextprotocol/adcp-client/blob/main/packages/eslint-plugin/README.md#${name}`);
+/**
+ * Build the active pattern set from the SDK defaults plus any
+ * adopter-supplied `additionalPatterns`. Adopters using
+ * `credentialPolicy.patterns.extend(...)` at runtime mirror the same
+ * strings here for lint parity. A fully-replaceable
+ * `credentialPolicy.matcher` function has no lint analogue — that's a
+ * known gap documented in the README.
+ */
+function buildPatternMatcher(extra) {
+    const extraRegexes = extra.map(p => new RegExp(p, 'i'));
+    const patterns = [...server_1.DEFAULT_CREDENTIAL_PATTERNS, ...extraRegexes];
+    return (name) => patterns.some(rx => rx.test(name));
+}
+/**
+ * Return the property name from a MemberExpression's `property` slot when
+ * the access is a plain identifier (`foo.bar`) or a string-literal computed
+ * access (`foo['bar']`). Returns `null` for dynamic / non-literal accesses
+ * — the rule cannot statically evaluate those and stays silent rather than
+ * false-positive.
+ */
+function propertyNameOf(node) {
+    if (!node.computed && node.property.type === utils_1.AST_NODE_TYPES.Identifier) {
+        return node.property.name;
+    }
+    if (node.computed && node.property.type === utils_1.AST_NODE_TYPES.Literal && typeof node.property.value === 'string') {
+        return node.property.value;
+    }
+    return null;
+}
+/**
+ * Walk an arbitrary expression and return `true` when it bottoms out on
+ * `<argsParamName>` — handles direct reference, `args.<x>`, and
+ * `args.<x>.<y>` chains. The rule fires when ANY MemberExpression in
+ * the chain reads a credential-shaped key, so detection is per-segment;
+ * this helper is the "is this rooted at args?" check used to scope the
+ * traversal.
+ */
+function isRootedAtIdentifier(expr, name) {
+    let cur = expr;
+    while (cur.type === utils_1.AST_NODE_TYPES.MemberExpression) {
+        cur = cur.object;
+    }
+    return cur.type === utils_1.AST_NODE_TYPES.Identifier && cur.name === name;
+}
+/**
+ * Extract the parameter name to scan for. The platform-method shape is
+ * `(args, ctx) => …` or `(args: SomeArgs, ctx) => …`. We key on the
+ * first parameter regardless of declared type — the rule is structural.
+ *
+ * Handles:
+ *   - Plain identifier: `(args) => …`
+ *   - Typed identifier: `(args: Foo) => …`
+ *   - Default-value: `(args = {}) => …` — unwrap `AssignmentPattern.left`
+ *   - Destructured first param: `({ access_token }) => …` (flagged via
+ *     the destructure scan, not via this name)
+ *   - Destructured with default: `({ access_token } = {}) => …` (same)
+ *
+ * Returns `null` when the function takes no params or when the first
+ * param has no nameable identifier (pure destructure).
+ */
+function firstParamIdentifierName(fn) {
+    const first = fn.params[0];
+    if (!first)
+        return null;
+    if (first.type === utils_1.AST_NODE_TYPES.Identifier)
+        return first.name;
+    if (first.type === utils_1.AST_NODE_TYPES.AssignmentPattern) {
+        const left = first.left;
+        if (left.type === utils_1.AST_NODE_TYPES.Identifier)
+            return left.name;
+    }
+    // ObjectPattern / ArrayPattern — destructure cases are caught by the
+    // ObjectPattern scan below, not here.
+    return null;
+}
+/**
+ * Walk the first parameter's `ObjectPattern` (including when wrapped in
+ * an `AssignmentPattern` for default-value forms like
+ * `({ access_token } = {})`) and collect every destructured key, including
+ * nested patterns. Reports paths like `args.context.access_token` so the
+ * error message reflects the depth of the destructure.
+ *
+ * Recurses through nested `ObjectPattern`s (`{ context: { access_token } }`)
+ * and handles renamed properties (`{ access_token: tok }` — fires on
+ * `access_token`, the source key, not the alias). `RestElement` is
+ * recorded as a binding but never matched against credential patterns:
+ * the post-extraction `rest.access_token` read is an aliasing pattern
+ * documented as out-of-scope.
+ */
+function destructuredKeys(fn) {
+    const first = fn.params[0];
+    if (!first)
+        return [];
+    let pattern = first;
+    if (pattern.type === utils_1.AST_NODE_TYPES.AssignmentPattern) {
+        pattern = pattern.left;
+    }
+    if (pattern.type !== utils_1.AST_NODE_TYPES.ObjectPattern)
+        return [];
+    const out = [];
+    collectObjectPatternKeys(pattern, ['args'], out);
+    return out;
+}
+/**
+ * Walk an ObjectPattern's properties, recursing into nested
+ * ObjectPatterns. `pathSoFar` accumulates the dotted-path segments used
+ * to render the error message (e.g. `['args', 'context']` →
+ * `args.context.access_token`).
+ */
+function collectObjectPatternKeys(pattern, pathSoFar, out) {
+    for (const prop of pattern.properties) {
+        if (prop.type === utils_1.AST_NODE_TYPES.RestElement)
+            continue;
+        if (prop.type !== utils_1.AST_NODE_TYPES.Property)
+            continue;
+        const keyName = propertyKeyName(prop.key, prop.computed);
+        if (keyName === null)
+            continue;
+        // `prop.value` is the binding target — either an Identifier (plain or
+        // renamed), an ObjectPattern (nested destructure), or an
+        // AssignmentPattern wrapping either of those.
+        let valueNode = prop.value;
+        if (valueNode.type === utils_1.AST_NODE_TYPES.AssignmentPattern) {
+            valueNode = valueNode.left;
+        }
+        if (valueNode.type === utils_1.AST_NODE_TYPES.ObjectPattern) {
+            collectObjectPatternKeys(valueNode, [...pathSoFar, keyName], out);
+            continue;
+        }
+        // Leaf binding — report at the source key (`prop.key`), not the
+        // alias (`prop.value`), so the error highlights the credential name
+        // the buyer would supply, not the local variable name the adopter
+        // chose.
+        out.push({
+            path: [...pathSoFar, keyName].join('.'),
+            node: prop.key,
+        });
+    }
+}
+function propertyKeyName(key, computed) {
+    if (!computed && key.type === utils_1.AST_NODE_TYPES.Identifier)
+        return key.name;
+    if (key.type === utils_1.AST_NODE_TYPES.Literal && typeof key.value === 'string')
+        return key.value;
+    return null;
+}
+/**
+ * Return the method name for any function node, when that function is
+ * itself the value of a property / method in an object literal or a class
+ * body. Returns `null` for free-standing function declarations or
+ * arrow-callback expressions whose enclosing context isn't a method
+ * binding. The rule fires only when this returns a name in
+ * {@link FLAGGED_METHOD_NAMES}.
+ *
+ * Cases handled:
+ *   - Object property: `{ extractContext: (args) => … }` / `{ extractContext(args) { … } }`
+ *   - Class method: `class Foo { extractContext(args) { … } }`
+ *
+ * `FunctionDeclaration`s (`function extractContext(args) { … }`) are
+ * intentionally NOT matched — free-standing functions named
+ * `extractContext` are rare and the false-positive cost outweighs the
+ * duck-typed coverage win.
+ */
+function methodNameForFunction(fn) {
+    if (fn.type === utils_1.AST_NODE_TYPES.FunctionDeclaration) {
+        return null;
+    }
+    const parent = fn.parent;
+    if (!parent)
+        return null;
+    if (parent.type === utils_1.AST_NODE_TYPES.Property) {
+        const key = parent.key;
+        if (!parent.computed && key.type === utils_1.AST_NODE_TYPES.Identifier)
+            return key.name;
+        if (key.type === utils_1.AST_NODE_TYPES.Literal && typeof key.value === 'string')
+            return key.value;
+        return null;
+    }
+    if (parent.type === utils_1.AST_NODE_TYPES.MethodDefinition) {
+        const key = parent.key;
+        if (!parent.computed && key.type === utils_1.AST_NODE_TYPES.Identifier)
+            return key.name;
+        if (key.type === utils_1.AST_NODE_TYPES.Literal && typeof key.value === 'string')
+            return key.value;
+        return null;
+    }
+    return null;
+}
+exports.default = createRule({
+    name: 'no-credential-read-from-args',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow reading credential-shaped keys off the buyer-supplied args bag inside extractContext / synthesizeFromArgs.',
+        },
+        messages: {
+            credentialReadFromArgs: 'Reading credential-shaped key {{path}} from `args` trusts buyer-supplied identity. Re-derive bearers per request from `ctx.authInfo` + your token cache; embed only non-secret upstream IDs in `args`.',
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    additionalPatterns: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        description: 'Extra regex patterns appended to DEFAULT_CREDENTIAL_PATTERNS. Mirror your credentialPolicy.patterns.extend contents here for lint parity.',
+                    },
+                },
+                additionalProperties: false,
+            },
+        ],
+    },
+    defaultOptions: [{}],
+    create(context) {
+        const options = context.options[0] ?? {};
+        const isCredentialName = buildPatternMatcher(options.additionalPatterns ?? []);
+        /**
+         * Stack of `{ argsParamName }` frames for the platform methods we're
+         * currently inside. The rule fires only when the stack is non-empty.
+         * Nested functions inside a flagged method inherit the parent frame;
+         * arrow callbacks that close over `args` still trip the scan.
+         */
+        const stack = [];
+        function enterFunction(fn) {
+            const methodName = methodNameForFunction(fn);
+            if (methodName !== null && FLAGGED_METHOD_NAMES.has(methodName)) {
+                const argsParamName = firstParamIdentifierName(fn);
+                stack.push({ argsParamName });
+                // Destructure form: `({ access_token, ... }) => …` (with or
+                // without an `AssignmentPattern` default-value wrapper, and
+                // including nested patterns) — flag at each leaf destructure
+                // site. MemberExpression traversal can't see these because the
+                // access never happens.
+                for (const { path, node } of destructuredKeys(fn)) {
+                    // `path` is `args.<...>.<key>`; the leaf segment is the key
+                    // whose name decides credential-shape.
+                    const segments = path.split('.');
+                    const leaf = segments[segments.length - 1];
+                    if (leaf && isCredentialName(leaf)) {
+                        context.report({
+                            node,
+                            messageId: 'credentialReadFromArgs',
+                            data: { path },
+                        });
+                    }
+                }
+            }
+        }
+        function exitFunction(fn) {
+            const methodName = methodNameForFunction(fn);
+            if (methodName !== null && FLAGGED_METHOD_NAMES.has(methodName)) {
+                stack.pop();
+            }
+        }
+        function currentFrame() {
+            if (stack.length === 0)
+                return null;
+            return stack[stack.length - 1] ?? null;
+        }
+        return {
+            FunctionDeclaration: enterFunction,
+            'FunctionDeclaration:exit': exitFunction,
+            FunctionExpression: enterFunction,
+            'FunctionExpression:exit': exitFunction,
+            ArrowFunctionExpression: enterFunction,
+            'ArrowFunctionExpression:exit': exitFunction,
+            VariableDeclarator(node) {
+                const frame = currentFrame();
+                if (!frame || frame.argsParamName === null)
+                    return;
+                // Only handle `const { ... } = args` shapes — the args parameter
+                // name has to appear on the right-hand side as an Identifier.
+                if (!node.init || node.init.type !== utils_1.AST_NODE_TYPES.Identifier)
+                    return;
+                if (node.init.name !== frame.argsParamName)
+                    return;
+                if (node.id.type !== utils_1.AST_NODE_TYPES.ObjectPattern)
+                    return;
+                const out = [];
+                collectObjectPatternKeys(node.id, [frame.argsParamName], out);
+                for (const entry of out) {
+                    const segments = entry.path.split('.');
+                    const leaf = segments[segments.length - 1];
+                    if (leaf && isCredentialName(leaf)) {
+                        context.report({
+                            node: entry.node,
+                            messageId: 'credentialReadFromArgs',
+                            data: { path: entry.path },
+                        });
+                    }
+                }
+            },
+            MemberExpression(node) {
+                const frame = currentFrame();
+                if (!frame || frame.argsParamName === null)
+                    return;
+                // Only scan accesses rooted at the args parameter.
+                if (!isRootedAtIdentifier(node.object, frame.argsParamName)) {
+                    return;
+                }
+                const propName = propertyNameOf(node);
+                if (propName === null)
+                    return;
+                if (!isCredentialName(propName))
+                    return;
+                // Reconstruct the dotted path for the error message. Walk from the
+                // member expression's leftmost identifier through each step.
+                const segments = [];
+                let cur = node;
+                while (cur.type === utils_1.AST_NODE_TYPES.MemberExpression) {
+                    const seg = propertyNameOf(cur);
+                    if (seg === null) {
+                        // Dynamic segment in the middle of the chain — bail; the error
+                        // message would be misleading. The current node's read is still
+                        // flagged on the way back up if it itself matches.
+                        segments.unshift('<dynamic>');
+                    }
+                    else {
+                        segments.unshift(seg);
+                    }
+                    cur = cur.object;
+                }
+                const path = `${frame.argsParamName}.${segments.join('.')}`;
+                context.report({
+                    node,
+                    messageId: 'credentialReadFromArgs',
+                    data: { path },
+                });
+            },
+        };
+    },
+});
+//# sourceMappingURL=no-credential-read-from-args.js.map

package/dist/rules/no-credential-read-from-args.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-credential-read-from-args.js","sourceRoot":"","sources":["../../src/rules/no-credential-read-from-args.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;;AAEH,oDAAiF;AACjF,6CAA+D;AAE/D,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAE/E,MAAM,UAAU,GAAG,mBAAW,CAAC,WAAW,CACxC,IAAI,CAAC,EAAE,CAAC,+FAA+F,IAAI,EAAE,CAC9G,CAAC;AAUF;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAAC,KAAe;IAC1C,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,CAAC,GAAG,oCAA2B,EAAE,GAAG,YAAY,CAAC,CAAC;IACnE,OAAO,CAAC,IAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,IAA+B;IACrD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,sBAAc,CAAC,UAAU,EAAE,CAAC;QACvE,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC5B,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,sBAAc,CAAC,OAAO,IAAI,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9G,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,IAAyB,EAAE,IAAY;IACnE,IAAI,GAAG,GAAwB,IAAI,CAAC;IACpC,OAAO,GAAG,CAAC,IAAI,KAAK,sBAAc,CAAC,gBAAgB,EAAE,CAAC;QACpD,GAAG,GAAG,GAAG,CAAC,MAA6B,CAAC;IAC1C,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,KAAK,sBAAc,CAAC,UAAU,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC;AACrE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,wBAAwB,CAC/B,EAAiG;IAEjG,MAAM,KAAK,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,KAAK,CAAC,IAAI,KAAK,sBAAc,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC;IAChE,IAAI,KAAK,CAAC,IAAI,KAAK,sBAAc,CAAC,iBAAiB,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACxB,IAAI,IAAI,CAAC,IAAI,KAAK,sBAAc,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IAChE,CAAC;IACD,qEAAqE;IACrE,sCAAsC;IACtC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,gBAAgB,CACvB,EAAiG;IAEjG,MAAM,KAAK,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IAEtB,IAAI,OAAO,GAAkB,KAAK,CAAC;IACnC,IAAI,OAAO,CAAC,IAAI,KAAK,sBAAc,CAAC,iBAAiB,EAAE,CAAC;QACtD,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IACzB,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,sBAAc,CAAC,aAAa;QAAE,OAAO,EAAE,CAAC;IAE7D,MAAM,GAAG,GAA4C,EAAE,CAAC;IACxD,wBAAwB,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IACjD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAS,wBAAwB,CAC/B,OAA+B,EAC/B,SAAmB,EACnB,GAA4C;IAE5C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,IAAI,KAAK,sBAAc,CAAC,WAAW;YAAE,SAAS;QACvD,IAAI,IAAI,CAAC,IAAI,KAAK,sBAAc,CAAC,QAAQ;YAAE,SAAS;QAEpD,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS;QAE/B,sEAAsE;QACtE,yDAAyD;QACzD,8CAA8C;QAC9C,IAAI,SAAS,GAAkB,IAAI,CAAC,KAAK,CAAC;QAC1C,IAAI,SAAS,CAAC,IAAI,KAAK,sBAAc,CAAC,iBAAiB,EAAE,CAAC;YACxD,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC;QAC7B,CAAC;QAED,IAAI,SAAS,CAAC,IAAI,KAAK,sBAAc,CAAC,aAAa,EAAE,CAAC;YACpD,wBAAwB,CAAC,SAAS,EAAE,CAAC,GAAG,SAAS,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;YAClE,SAAS;QACX,CAAC;QAED,gEAAgE;QAChE,oEAAoE;QACpE,kEAAkE;QAClE,SAAS;QACT,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,CAAC,GAAG,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACvC,IAAI,EAAE,IAAI,CAAC,GAAG;SACf,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,GAAgD,EAAE,QAAiB;IAC1F,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,sBAAc,CAAC,UAAU;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC;IACzE,IAAI,GAAG,CAAC,IAAI,KAAK,sBAAc,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC;IAC3F,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,qBAAqB,CAC5B,EAAiG;IAEjG,IAAI,EAAE,CAAC,IAAI,KAAK,sBAAc,CAAC,mBAAmB,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAI,EAA4C,CAAC,MAAM,CAAC;IACpE,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,IAAI,MAAM,CAAC,IAAI,KAAK,sBAAc,CAAC,QAAQ,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,sBAAc,CAAC,UAAU;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC;QAChF,IAAI,GAAG,CAAC,IAAI,KAAK,sBAAc,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC;QAC3F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,sBAAc,CAAC,gBAAgB,EAAE,CAAC;QACpD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,sBAAc,CAAC,UAAU;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC;QAChF,IAAI,GAAG,CAAC,IAAI,KAAK,sBAAc,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC;QAC3F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kBAAe,UAAU,CAAsB;IAC7C,IAAI,EAAE,8BAA8B;IACpC,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EACT,qHAAqH;SACxH;QACD,QAAQ,EAAE;YACR,sBAAsB,EACpB,wMAAwM;SAC3M;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,kBAAkB,EAAE;wBAClB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,WAAW,EACT,2IAA2I;qBAC9I;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE,CAAC,EAAE,CAAC;IACpB,MAAM,CAAC,OAAO;QACZ,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;QAE/E;;;;;WAKG;QACH,MAAM,KAAK,GAAuC,EAAE,CAAC;QAErD,SAAS,aAAa,CACpB,EAAiG;YAEjG,MAAM,UAAU,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;YAC7C,IAAI,UAAU,KAAK,IAAI,IAAI,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChE,MAAM,aAAa,GAAG,wBAAwB,CAAC,EAAE,CAAC,CAAC;gBACnD,KAAK,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;gBAE9B,4DAA4D;gBAC5D,4DAA4D;gBAC5D,6DAA6D;gBAC7D,+DAA+D;gBAC/D,wBAAwB;gBACxB,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,gBAAgB,CAAC,EAAE,CAAC,EAAE,CAAC;oBAClD,4DAA4D;oBAC5D,uCAAuC;oBACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;oBAC3C,IAAI,IAAI,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;wBACnC,OAAO,CAAC,MAAM,CAAC;4BACb,IAAI;4BACJ,SAAS,EAAE,wBAAwB;4BACnC,IAAI,EAAE,EAAE,IAAI,EAAE;yBACf,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,SAAS,YAAY,CACnB,EAAiG;YAEjG,MAAM,UAAU,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;YAC7C,IAAI,UAAU,KAAK,IAAI,IAAI,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChE,KAAK,CAAC,GAAG,EAAE,CAAC;YACd,CAAC;QACH,CAAC;QAED,SAAS,YAAY;YACnB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpC,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;QACzC,CAAC;QAED,OAAO;YACL,mBAAmB,EAAE,aAAa;YAClC,0BAA0B,EAAE,YAAY;YACxC,kBAAkB,EAAE,aAAa;YACjC,yBAAyB,EAAE,YAAY;YACvC,uBAAuB,EAAE,aAAa;YACtC,8BAA8B,EAAE,YAAY;YAE5C,kBAAkB,CAAC,IAAiC;gBAClD,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;gBAC7B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI;oBAAE,OAAO;gBAEnD,iEAAiE;gBACjE,8DAA8D;gBAC9D,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,sBAAc,CAAC,UAAU;oBAAE,OAAO;gBACvE,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,aAAa;oBAAE,OAAO;gBACnD,IAAI,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,sBAAc,CAAC,aAAa;oBAAE,OAAO;gBAE1D,MAAM,GAAG,GAA4C,EAAE,CAAC;gBACxD,wBAAwB,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;gBAC9D,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;oBACxB,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;oBAC3C,IAAI,IAAI,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;wBACnC,OAAO,CAAC,MAAM,CAAC;4BACb,IAAI,EAAE,KAAK,CAAC,IAAI;4BAChB,SAAS,EAAE,wBAAwB;4BACnC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;yBAC3B,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YAED,gBAAgB,CAAC,IAA+B;gBAC9C,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;gBAC7B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI;oBAAE,OAAO;gBAEnD,mDAAmD;gBACnD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAA6B,EAAE,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;oBACnF,OAAO;gBACT,CAAC;gBAED,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;gBACtC,IAAI,QAAQ,KAAK,IAAI;oBAAE,OAAO;gBAC9B,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC;oBAAE,OAAO;gBAExC,mEAAmE;gBACnE,6DAA6D;gBAC7D,MAAM,QAAQ,GAAa,EAAE,CAAC;gBAC9B,IAAI,GAAG,GAAwB,IAAI,CAAC;gBACpC,OAAO,GAAG,CAAC,IAAI,KAAK,sBAAc,CAAC,gBAAgB,EAAE,CAAC;oBACpD,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;oBAChC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;wBACjB,+DAA+D;wBAC/D,gEAAgE;wBAChE,mDAAmD;wBACnD,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;oBAChC,CAAC;yBAAM,CAAC;wBACN,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBACxB,CAAC;oBACD,GAAG,GAAG,GAAG,CAAC,MAA6B,CAAC;gBAC1C,CAAC;gBACD,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,aAAa,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAE5D,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,wBAAwB;oBACnC,IAAI,EAAE,EAAE,IAAI,EAAE;iBACf,CAAC,CAAC;YACL,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@adcp/eslint-plugin",
+  "version": "0.0.0",
+  "description": "ESLint rules for AdCP adopters — flags credential-handling antipatterns at lint time. Build-time sibling to the SDK's `credentialPolicy: 'authInfo-only'` runtime guard.",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "type": "commonjs",
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "tsx --test --test-force-exit test/*.test.ts",
+    "clean": "rm -rf dist/"
+  },
+  "keywords": [
+    "adcp",
+    "eslint",
+    "eslint-plugin",
+    "credentials",
+    "security"
+  ],
+  "author": {
+    "name": "AdCP Community",
+    "email": "maintainers@adcontextprotocol.org",
+    "url": "https://adcontextprotocol.org"
+  },
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/adcontextprotocol/adcp-client.git",
+    "directory": "packages/eslint-plugin"
+  },
+  "homepage": "https://github.com/adcontextprotocol/adcp-client#readme",
+  "bugs": {
+    "url": "https://github.com/adcontextprotocol/adcp-client/issues"
+  },
+  "peerDependencies": {
+    "eslint": "^8.0.0 || ^9.0.0 || ^10.0.0"
+  },
+  "dependencies": {
+    "@adcp/sdk": "^7.3.0",
+    "@typescript-eslint/utils": "^8.0.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.3.0"
+  }
+}